<html>
<head><meta charset="utf-8"><title>Type Privacy &amp; Safety · project-safe-transmute · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/index.html">project-safe-transmute</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html">Type Privacy &amp; Safety</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="214338523"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214338523" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214338523">(Oct 23 2020 at 16:58)</a>:</h4>
<p>@Ralf, you <a href="https://github.com/rust-lang/rfcs/pull/2981#issuecomment-714672477">asked</a>:</p>
<blockquote>
<p>But for these "publicly unnameable type", what does the reasoning look like? I am not asking for a PhD thesis working this out in full detail, but even explaining on an intuitive level how extra invariants arise here, what they are attached to and where unsafe (?) code needs to ensure they are upheld would help.</p>
</blockquote>
<p>I <a href="https://github.com/rust-lang/rfcs/pull/2981#issuecomment-715402660">responded</a>:</p>
<blockquote>
<p>I'll try to sketch this out sometime in the next week. Briefly: The safety invariant on <code>Here!()</code> that is that the resulting type should not appear (<a href="https://github.com/rust-lang/rfcs/blob/master/text/2145-type-privacy.md#how-to-determine-visibility-of-a-type">per the type privacy rules</a>) in the public API of the module it's invoked in.</p>
</blockquote>
<p>Before I try to elaborate, though, I want to make sure that I do so in a direction that's <em>actually</em> helpful.</p>



<a name="214410262"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214410262" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214410262">(Oct 24 2020 at 05:16)</a>:</h4>
<p>(If you meant to ping them, you have to include the J at the end.)</p>



<a name="214426713"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214426713" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214426713">(Oct 24 2020 at 13:02)</a>:</h4>
<p>(yeah that ping didn't work, just noticed this by accident^^)</p>



<a name="214426747"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214426747" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214426747">(Oct 24 2020 at 13:03)</a>:</h4>
<blockquote>
<p>I'll try to sketch this out sometime in the next week. Briefly: The safety invariant on Here!() that is that the resulting type should not appear (per the type privacy rules) in the public API of the module it's invoked in.</p>
</blockquote>
<p>Is that enough? Don't you also need to ensure that nothing inside this module calls generic functions outside the module with the "private type" as a parameter? That seems really hard to ensure.</p>



<a name="214426853"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214426853" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214426853">(Oct 24 2020 at 13:05)</a>:</h4>
<p>No, that sort of delegation is the whole point of making <code>Scope</code> an explicit type parameter.</p>



<a name="214427186"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427186" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427186">(Oct 24 2020 at 13:12)</a>:</h4>
<p>oh... that seems extremely subtle then. how do you protect against accidentally leaking the type?</p>



<a name="214427202"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427202" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427202">(Oct 24 2020 at 13:13)</a>:</h4>
<p>also doesn't this mean you assume that the called code does not somehow "store" the type through mechanisms such as <code>dyn Trait</code> or <code>type_id</code>?</p>



<a name="214427446"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427446" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427446">(Oct 24 2020 at 13:18)</a>:</h4>
<p>The type privacy rules seem to do a REALLY good of job if making it impossible to leak <code>Here!()</code>.</p>
<p>You assume the called code upholds its contract. I'm not sure about storing mechanisms. There is no <code>Scope</code> trait. I'm not sure how <code>type_id</code> would be used to store a type in a recoverable way.</p>



<a name="214427486"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427486" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427486">(Oct 24 2020 at 13:19)</a>:</h4>
<blockquote>
<p>The type privacy rules seem to do a REALLY good of job if making it impossible to leak Here!().</p>
</blockquote>
<p>Ugh... so we're relying on those rules accidentally being entirely airtight? My impression was that these are mostly a lint</p>



<a name="214427530"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427530" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427530">(Oct 24 2020 at 13:20)</a>:</h4>
<p>They seem to be errors.</p>



<a name="214427533"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427533" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427533">(Oct 24 2020 at 13:20)</a>:</h4>
<p>(All of this is a somewhat moot point since this mechanism needs to be removed from the RFC.)</p>



<a name="214427536"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427536" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427536">(Oct 24 2020 at 13:20)</a>:</h4>
<p>sure, I didnt mean on the technical level</p>



<a name="214427540"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427540" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427540">(Oct 24 2020 at 13:20)</a>:</h4>
<p>more like how <code>mut</code> is a lint</p>



<a name="214427550"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427550" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427550">(Oct 24 2020 at 13:20)</a>:</h4>
<p>Gotcha.</p>



<a name="214427560"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427560" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427560">(Oct 24 2020 at 13:21)</a>:</h4>
<p>as in, it's good to have the compiler prevent is from mutating all locals, but it's not critical for the safety story or so</p>



<a name="214427576"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427576" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427576">(Oct 24 2020 at 13:21)</a>:</h4>
<blockquote>
<p>There is no Scope trait. </p>
</blockquote>
<p>Sure... but you could use <code>dyn Any</code> or so I assume? Or do you rely on <code>Scope</code> not implementing <em>any</em> trait whatsoever?</p>



<a name="214427627"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427627" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427627">(Oct 24 2020 at 13:22)</a>:</h4>
<p><span class="user-mention silent" data-user-id="219211">Jack Wrenn</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety/near/214427533">said</a>:</p>
<blockquote>
<p>(All of this is a somewhat moot point since this mechanism needs to be removed from the RFC.)</p>
</blockquote>
<p>I find it independently intellectually interesting to figure out what this mechanism relies on and what it can be used for -- but I can understand if you want to focus on more productive discussions.^^</p>



<a name="214427691"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427691" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427691">(Oct 24 2020 at 13:24)</a>:</h4>
<blockquote>
<p>The type privacy rules seem to do a REALLY good of job if making it impossible to leak Here!().</p>
</blockquote>
<p>I seem to recall proposals to relax those rules... but I do not remember what the status of that is</p>



<a name="214427693"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427693" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427693">(Oct 24 2020 at 13:24)</a>:</h4>
<p>No, I find it interesting too. There is a fundamental safety discussion here: whether the type privacy rules can be used for safety guarantees.</p>



<a name="214427710"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427710" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427710">(Oct 24 2020 at 13:24)</a>:</h4>
<p>I'm currently on mobile, but try playing around with this example: <a href="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=c711d84abd5187cdb52d90d603601da6">https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=c711d84abd5187cdb52d90d603601da6</a></p>



<a name="214427723"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427723" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427723">(Oct 24 2020 at 13:25)</a>:</h4>
<p>OTOH <a href="https://github.com/rust-lang/rfcs/blob/master/text/0136-no-privates-in-public.md">https://github.com/rust-lang/rfcs/blob/master/text/0136-no-privates-in-public.md</a> seems to support your statement that this is something one should be able to rely on</p>



<a name="214427726"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427726" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427726">(Oct 24 2020 at 13:25)</a>:</h4>
<p>Using impl Any also produces hard errors.</p>



<a name="214427831"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427831" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427831">(Oct 24 2020 at 13:27)</a>:</h4>
<p>ah I mean this one I think: <a href="https://github.com/rust-lang/rfcs/pull/2145">https://github.com/rust-lang/rfcs/pull/2145</a></p>



<a name="214427836"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427836" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427836">(Oct 24 2020 at 13:27)</a>:</h4>
<p>latest text: <a href="https://github.com/rust-lang/rfcs/blob/master/text/2145-type-privacy.md">https://github.com/rust-lang/rfcs/blob/master/text/2145-type-privacy.md</a></p>



<a name="214427838"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427838" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427838">(Oct 24 2020 at 13:27)</a>:</h4>
<p>Yeah, that's the RFC I've been referencing. :)</p>



<a name="214427937"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427937" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427937">(Oct 24 2020 at 13:29)</a>:</h4>
<p>right, that still builds on type privacy. seems like I misremembered.</p>



<a name="214427996"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214427996" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214427996">(Oct 24 2020 at 13:30)</a>:</h4>
<p>okay so <code>dyn Trait</code> smuggling cannot work if the type is uninhabited</p>



<a name="214428160"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214428160" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214428160">(Oct 24 2020 at 13:34)</a>:</h4>
<p><span class="user-mention silent" data-user-id="219211">Jack Wrenn</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety/near/214426853">said</a>:</p>
<blockquote>
<p>No, that sort of delegation is the whole point of making <code>Scope</code> an explicit type parameter.</p>
</blockquote>
<p>That however feels like quite the departure from the line of arguments you follow in the RFC -- that this is about relying on the tried-and-proven concept of visibility. Rust's visibility system does not have a notion of delegation after all. My private fields can be accessed only inside the module, not inside this module <em>and all other modules I delegate my scope handle to</em> (deliberately or accidentally). So this does introduce an entirely new kind of visibility system that requires different reasoning principles to support delegation.</p>



<a name="214428265"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214428265" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214428265">(Oct 24 2020 at 13:36)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety/near/214427996">said</a>:</p>
<blockquote>
<p>okay so <code>dyn Trait</code> smuggling cannot work if the type is uninhabited</p>
</blockquote>
<p>(but IIRC your blogpost does not say that making the type uninhabited is crucial, so I wonder what this means for type-privacy-based reasoning in general... probably that you must never leak a value of this type outside the module)</p>



<a name="214428275"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214428275" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214428275">(Oct 24 2020 at 13:36)</a>:</h4>
<p>I can see that argument.</p>



<a name="214428362"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214428362" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214428362">(Oct 24 2020 at 13:38)</a>:</h4>
<blockquote>
<p>So this does introduce an entirely new kind of visibility system that requires different reasoning principles to support delegation.</p>
</blockquote>
<p>Or, well, maybe I should say it introduces a significant extension of the visibility system.</p>



<a name="214428366"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214428366" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214428366">(Oct 24 2020 at 13:38)</a>:</h4>
<p>The <em>goal</em> is to express the constructability analysis in-language in a way that reflects the visibility of fields.</p>



<a name="214428404"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214428404" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214428404">(Oct 24 2020 at 13:39)</a>:</h4>
<p><span class="user-mention silent" data-user-id="219211">Jack Wrenn</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety/near/214428366">said</a>:</p>
<blockquote>
<p>The <em>goal</em> is to express the constructability analysis in-language in a way that reflects the visibility of fields.</p>
</blockquote>
<p>Yeah I understood that. In the RFC thread I am arguing that this might not be a goal we want to pursue; but for the purpose of this discussion I am willing to take that as a given and explore how we might reach it.</p>



<a name="214428710"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214428710" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214428710">(Oct 24 2020 at 13:45)</a>:</h4>
<p>FWIW I cannot think of any way to do weird things with <code>type_id</code> either... it's not like you can synthesize the type name <code>T</code> at compile time even if you have its ID at runtime.</p>



<a name="214428711"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214428711" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214428711">(Oct 24 2020 at 13:45)</a>:</h4>
<p>So the qualm, as I understand it, is that access to <code>Scope</code> gives you the ability to fiddle with fields via transmutation.</p>
<p>Rust has a few mechanisms for letting outsiders fiddle with a type's innards. The primary mechanism is field visibility. <code>DerefMut</code> also comes to mind. In both cases,  if you do not want outsiders to have access to your type's innards, you don't make your fields pub for unwelcome parties, or impl DerefMut.</p>
<p>Analogously: don't delegate <code>Here!()</code> if your type has internal invariants it needs to maintain.</p>



<a name="214428721"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214428721" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214428721">(Oct 24 2020 at 13:45)</a>:</h4>
<p>however, that RFC explicitly mentions <code>impl Trait</code> as a way to "leak" private types, I wonder if there is anything there</p>



<a name="214428801"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214428801" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214428801">(Oct 24 2020 at 13:47)</a>:</h4>
<blockquote>
<p>Analogously: don't delegate Here!() if your type has internal invariants it needs to maintain.</p>
</blockquote>
<p>That's a completely new kind of thing to be wary of though. Now I need to, what, carefully audit every call to other crates' functions to see if the (entirely implicit!) type parameters leak my scope, or so?</p>



<a name="214428828"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214428828" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214428828">(Oct 24 2020 at 13:47)</a>:</h4>
<p>so far it's all about visibility, and then about code I write that works on private fields -- <code>impl DerefMut</code> alone is not enough, it needs actual code in there that works with my private field.</p>



<a name="214428880"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214428880" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214428880">(Oct 24 2020 at 13:48)</a>:</h4>
<p>unsafe code authors in rust are used to auditing what happens with their private fields, and this is not even Rust-specific, many languages work this way</p>



<a name="214429921"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214429921" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214429921">(Oct 24 2020 at 14:10)</a>:</h4>
<blockquote>
<p>Now I need to, what, carefully audit every call to other crates' functions to see if the (entirely implicit!) type parameters leak my scope, or so?</p>
</blockquote>
<p>Also this makes type inference failing on ambiguity safety-critical... at least I think this is the only barrier protecting us from these implicit parameters changing in the future to actually leak the thing we do not want to leak.<br>
Maybe I am overestimating how hard this would be in practice, but it seems at least potentially problematic.</p>



<a name="214432006"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/214432006" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#214432006">(Oct 24 2020 at 14:59)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety/near/214428160">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="219211">Jack Wrenn</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety/near/214426853">said</a>:</p>
<blockquote>
<p>No, that sort of delegation is the whole point of making <code>Scope</code> an explicit type parameter.</p>
</blockquote>
<p>That however feels like quite the departure from the line of arguments you follow in the RFC -- that this is about relying on the tried-and-proven concept of visibility. Rust's visibility system does not have a notion of delegation after all. My private fields can be accessed only inside the module, not inside this module <em>and all other modules I delegate my scope handle to</em> (deliberately or accidentally). So this does introduce an entirely new kind of visibility system that requires different reasoning principles to support delegation.</p>
</blockquote>
<p>I think this is a fair point, so what I'd suggest is to have a special syntax to signify this:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="sd">//! Modulo exact syntax bikeshed, of course</span>

<span class="k">mod</span> <span class="nn">boundary</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="n">Here</span><span class="o">!</span><span class="p">();</span><span class="w"></span>

<span class="w">    </span><span class="cp">#[safe_transmute_attrs]</span><span class="w"></span>
<span class="w">    </span><span class="k">pub</span><span class="w"></span>
<span class="w">    </span><span class="k">struct</span> <span class="nc">MyNonZeroU8</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="k">pub</span><span class="p">(</span><span class="k">in</span><span class="w"> </span><span class="n">Here</span><span class="p">)</span><span class="w"> </span><span class="c1">// expresses that the `Here` token grants visibility and thus access to `.value`</span>
<span class="w">        </span><span class="n">value</span>: <span class="kt">u8</span><span class="p">,</span><span class="w"></span>

<span class="w">        </span><span class="o">..</span><span class="p">.</span><span class="w"></span>
<span class="w">    </span><span class="p">}</span><span class="w"></span>

<span class="w">    </span><span class="k">impl</span><span class="w"> </span><span class="n">MyNonZeroU8</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="k">pub</span><span class="w"></span>
<span class="w">        </span><span class="k">fn</span> <span class="nf">new</span><span class="w"> </span><span class="p">(</span><span class="n">value</span>: <span class="kt">u8</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="nb">Option</span><span class="o">&lt;</span><span class="bp">Self</span><span class="o">&gt;</span><span class="w"></span>
<span class="w">        </span><span class="o">..</span><span class="p">.</span><span class="w"></span>

<span class="w">        </span><span class="k">pub</span><span class="w"></span>
<span class="w">        </span><span class="k">fn</span> <span class="nf">get_value</span><span class="w"> </span><span class="p">(</span><span class="o">&amp;</span><span class="bp">self</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="nc">NonZeroU8</span><span class="w"></span>
<span class="w">        </span><span class="p">{</span><span class="w"></span>
<span class="w">            </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">                </span><span class="c1">// Safety: within the `boundary`, the `Here` token has been given to:</span>
<span class="w">                </span><span class="c1">//  1. neither an API that would then alter `.value`,</span>
<span class="w">                </span><span class="c1">//  2. nor an unknown generic API (since it could, transitively, lead to `1.`)</span>
<span class="w">                </span><span class="n">NonZeroU8</span>::<span class="n">new_unchecked</span><span class="p">(</span><span class="bp">self</span><span class="p">.</span><span class="n">value</span><span class="p">)</span><span class="w"></span>
<span class="w">            </span><span class="p">}</span><span class="w"></span>
<span class="w">        </span><span class="p">}</span><span class="w"></span>
<span class="w">    </span><span class="p">}</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>



<a name="215396999"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/215396999" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#215396999">(Nov 03 2020 at 00:18)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety/near/214428265">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety/near/214427996">said</a>:</p>
<blockquote>
<p>okay so <code>dyn Trait</code> smuggling cannot work if the type is uninhabited</p>
</blockquote>
<p>(but IIRC your blogpost does not say that making the type uninhabited is crucial, so I wonder what this means for type-privacy-based reasoning in general... probably that you must never leak a value of this type outside the module)</p>
</blockquote>
<p>What's the routine for calling <code>ctf()</code> using <code>dyn Trait</code> if <code>Here</code> <em>is</em> inhabited?</p>



<a name="216002557"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216002557" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216002557">(Nov 08 2020 at 11:25)</a>:</h4>
<p>I think I was imagining <a href="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=628723dd4f7cd94625d61ccc45f16328">something like this</a>... this does not quite work but maybe with specialization it does?</p>



<a name="216002569"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216002569" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216002569">(Nov 08 2020 at 11:25)</a>:</h4>
<p>AFAIK specialization is intended to "see through" <code>impl Trait</code></p>



<a name="216002577"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216002577" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216002577">(Nov 08 2020 at 11:25)</a>:</h4>
<p>(not sure what I had in mind with <code>dyn Trait</code> TBH)</p>



<a name="216525675"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216525675" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216525675">(Nov 12 2020 at 20:44)</a>:</h4>
<p>Some archeology: The type privacy rules <a href="https://github.com/rust-lang/rfcs/pull/2145#issuecomment-329023808">sprung</a> from <a href="https://internals.rust-lang.org/t/lang-team-minutes-private-in-public-rules/4504">this internals discussion</a>, which sheds some light on the motivation behind it:</p>
<blockquote>
<p>Their intention is to ensure that if you have a private struct, then nobody outside of the module can get their hands on an instance of that struct, and nor can they name the type. This implies that <strong>methods defined on that private struct (<em>including methods from public traits like <code>Clone</code> which don’t have privacy protections</em>) cannot be invoked except for within the module that defined it</strong>. <strong>This is a useful guarantee for unsafe code.</strong></p>
</blockquote>
<p>(emphasis mine)</p>
<p>"Local" trait implementations weren't a hacky accident of type privacy—they were a key motivation!</p>



<a name="216588075"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216588075" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216588075">(Nov 13 2020 at 09:45)</a>:</h4>
<p>but note that that comment is about "methods on that struct", i.e., methods that <em>actually take some value of the struct as a parameter</em> (possibly by reference)</p>



<a name="216588086"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216588086" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216588086">(Nov 13 2020 at 09:45)</a>:</h4>
<p>that is a very different approach from what you have been doing, where there is no value, just a type parameter</p>



<a name="216609923"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216609923" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216609923">(Nov 13 2020 at 13:31)</a>:</h4>
<p>The Type Privacy RFC makes no such distinction—it doesn't treat type privacy differently based on whether a value is involved or not.</p>



<a name="216627236"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216627236" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216627236">(Nov 13 2020 at 15:34)</a>:</h4>
<p>Actually, it's <a href="https://github.com/petrochenkov/rfcs/blob/9901089b2467b0813456479ba03642e9f0ac0912/text/0000-type-privacy.md#additional-restrictions-for-associated-items">explicit about this point</a>:</p>
<blockquote>
<p>When associated function is defined in a private impl (i.e. the impl type or trait is private) it's guaranteed that the function can't be used outside of the impl's area of visibility. [...] As a result, type privacy additionally prohibits use of any associated items from private impls.</p>
</blockquote>



<a name="216725894"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216725894" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216725894">(Nov 14 2020 at 12:17)</a>:</h4>
<blockquote>
<p>type privacy additionally prohibits use of any associated items from private impls.</p>
</blockquote>
<p>Interesting.<br>
However, IIRC, in your proposal, it the "protected" item wasn't even an associated item of the "private impl", right? IIRC <code>Scope</code> was a marker trait, so it has no associated items. It was more like the private impl enabling other (public) impls to be used and then <em>those</em> have associated items that are useful?</p>



<a name="216726397"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216726397" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216726397">(Nov 14 2020 at 12:31)</a>:</h4>
<p>Scope isn't a trait at all. It's a type parameter on <code>TransmuteFrom</code> that, when instantiated with a private type (<code>Here!()</code>), makes an implementation of <code>TransmuteFrom</code> a "private impl".</p>
<p>Since <code>TransmuteFrom</code> is a private impl, you can't call its <code>transmute_from</code> associated function.</p>



<a name="216728859"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216728859" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216728859">(Nov 14 2020 at 13:22)</a>:</h4>
<p>sorry, yeah, I am mixing things up again.<br>
I think you are still slightly extending what is described there though: "the impl type or trait is private" is extended to also include "a type parameter of the impl type is private".</p>



<a name="216728873"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216728873" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216728873">(Nov 14 2020 at 13:23)</a>:</h4>
<p>which maybe doesn't make such a big difference, I dont have good enough intuition for this to tell</p>



<a name="216736210"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216736210" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216736210">(Nov 14 2020 at 16:04)</a>:</h4>
<p>I think that behavior is described here:</p>
<blockquote>
<ul>
<li>Traits or trait types are as visible as their least visible type argument or trait constructor.<br>
<code>vis(Tr&lt;A, B&gt;) = min(vis(Tr), vis(A), vis(B))</code>.</li>
</ul>
</blockquote>
<p>The RFC could be phrased a little more clearly here. I believe this is referring to trait <em>implementations</em>, since it's only in the context of implementations that trait type arguments have any privacy at all (per the second bullet point on that list).</p>
<p>There's also this next bullet point:</p>
<blockquote>
<ul>
<li>Trait objects and impl Trait types are as visible as their least visible component.<br>
<code>vis(TrA + TrB) = vis(impl TrA + TrB) = min(vis(TrA), vis(TrB)).</code></li>
</ul>
</blockquote>



<a name="216736799"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216736799" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216736799">(Nov 14 2020 at 16:17)</a>:</h4>
<p>Another relevant bullet point:</p>
<blockquote>
<p>For trait methods components include signature, trait, <strong>type parameters</strong> (including impl type Self) and the method item's nominal visibility (inherited from the trait, included automatically).<br>
<code>vis(fn(A, B) -&gt; R { &lt;Type as Trait&gt;::foo&lt;C&gt; })) = min(vis(fn(A, B) -&gt; R), vis(C), vis(Type), vis(Trait)).</code></p>
</blockquote>
<p>(emphasis mine)</p>



<a name="216737775"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216737775" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216737775">(Nov 14 2020 at 16:38)</a>:</h4>
<p>Anyways, perhaps <a href="https://github.com/rust-lang/rfcs/pull/2145#issuecomment-727232373">best to go to the source</a>!</p>



<a name="216738718"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216738718" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216738718">(Nov 14 2020 at 16:54)</a>:</h4>
<p>And a <a href="https://github.com/rust-lang/rfcs/pull/2145#issuecomment-727233646">response</a>!</p>
<blockquote>
<p>There is this line</p>
<blockquote>
<p>When associated function is defined in a <strong>private impl (i.e. the impl type or trait is private)</strong> it's guaranteed that the function can't be used outside of the impl's area of visibility.</p>
</blockquote>
<p>where "impl type or trait" include their generic parameters as well.</p>
</blockquote>



<a name="216786661"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216786661" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216786661">(Nov 15 2020 at 11:25)</a>:</h4>
<p>I see, thanks!</p>



<a name="216786711"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216786711" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216786711">(Nov 15 2020 at 11:26)</a>:</h4>
<p>so do we have "private impls" in Rust unbeknownst do the lang team? that doesn't seem right either^^</p>



<a name="216786726"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216786726" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216786726">(Nov 15 2020 at 11:27)</a>:</h4>
<p>personally, I really hope someone can model this formally some day. I won't trust it until I know how to prove it. but I also know my standards are absurdly high.</p>



<a name="216805918"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216805918" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Vadim Petrochenkov <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216805918">(Nov 15 2020 at 18:14)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety/near/214427486">said</a>:</p>
<blockquote>
<blockquote>
<p>The type privacy rules seem to do a REALLY good of job if making it impossible to leak Here!().</p>
</blockquote>
<p>Ugh... so we're relying on those rules accidentally being entirely airtight? My impression was that these are mostly a lint</p>
</blockquote>
<p>They are very intentionally airtight.<br>
If they were not we could get link-time errors on use of private entities because our link-time symbol exporting strategy is based on type privacy.</p>



<a name="216805944"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216805944" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Vadim Petrochenkov <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216805944">(Nov 15 2020 at 18:15)</a>:</h4>
<p>(The alternative would be exporting <em>everything</em> at link time, but that's certainly not good.)</p>



<a name="216809786"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216809786" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216809786">(Nov 15 2020 at 19:38)</a>:</h4>
<p>well, it is possible to explicitly "leak" these types to enable delegation though, or at leats I thought we had that established?</p>



<a name="216810103"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216810103" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216810103">(Nov 15 2020 at 19:43)</a>:</h4>
<p><span class="user-mention" data-user-id="123856">@Vadim Petrochenkov</span> can answer better than I, but I'm pretty those apparent "leaks" disappear after monomorphization.</p>



<a name="216810415"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216810415" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Vadim Petrochenkov <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216810415">(Nov 15 2020 at 19:48)</a>:</h4>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety/near/216809786">said</a>:</p>
<blockquote>
<p>well, it is possible to explicitly "leak" these types to enable delegation though, or at leats I thought we had that established?</p>
</blockquote>
<p>I'm not sure what delegation you are talking about.</p>



<a name="216811229"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216811229" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216811229">(Nov 15 2020 at 20:00)</a>:</h4>
<p>I <em>think</em> <span class="user-mention" data-user-id="120791">@RalfJ</span> is referring to this sort of situation in "crate_c": <a href="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=5f224f0fac59f412d9c71435d576a524">https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=5f224f0fac59f412d9c71435d576a524</a></p>
<p>(I edited this example a few times, <span class="user-mention" data-user-id="123856">@Vadim Petrochenkov</span>, so if you already clicked the link, click again!)</p>



<a name="216822070"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216822070" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216822070">(Nov 16 2020 at 00:10)</a>:</h4>
<p>A similar case of this in the standard library is <code>From</code> and <code>Into</code>.</p>
<p>If you define a private implementation of <code>From</code>; i.e., either:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">struct</span> <span class="nc">Private</span><span class="p">;</span><span class="w"></span>
<span class="k">pub</span><span class="w"> </span><span class="k">struct</span> <span class="nc">Public</span><span class="p">;</span><span class="w"></span>

<span class="k">impl</span><span class="w"> </span><span class="nb">From</span><span class="o">&lt;</span><span class="n">Private</span><span class="o">&gt;</span><span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="n">Public</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="o">..</span><span class="p">.</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="k">impl</span><span class="w"> </span><span class="nb">From</span><span class="o">&lt;</span><span class="n">Public</span><span class="o">&gt;</span><span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="n">Private</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="o">..</span><span class="p">.</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
</code></pre></div>
<p>...then <em>you</em> can still take advantage of the blanket impl on <code>Into</code> provided by libcore. For instance, if a third-party crate defines a function:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">pub</span><span class="w"> </span><span class="k">fn</span> <span class="nf">is_convertible</span><span class="o">&lt;</span><span class="n">T</span><span class="p">,</span><span class="w"> </span><span class="n">U</span><span class="o">&gt;</span><span class="w"></span>
<span class="k">where</span><span class="w"></span>
<span class="w">    </span><span class="n">T</span>: <span class="nb">Into</span><span class="o">&lt;</span><span class="n">U</span><span class="o">&gt;</span><span class="w"></span>
<span class="p">{}</span><span class="w"></span>
</code></pre></div>
<p><em>you</em> can call that function with <code>Public</code> and <code>Private</code> <em>even though the implementations of <code>From</code> for those types is private</em>.</p>



<a name="216822262"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216822262" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216822262">(Nov 16 2020 at 00:14)</a>:</h4>
<p>how would you call that with <code>Public</code> and <code>Private</code> if <code>Private</code> is not accessible?</p>



<a name="216822272"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216822272" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216822272">(Nov 16 2020 at 00:15)</a>:</h4>
<p>It's only <em>within</em> the module defining <code>Public</code> and <code>Private</code> can you make that call.</p>



<a name="216822346"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216822346" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216822346">(Nov 16 2020 at 00:17)</a>:</h4>
<p>but then the impls are visible too?</p>



<a name="216822385"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216822385" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216822385">(Nov 16 2020 at 00:18)</a>:</h4>
<p>Yes, within the module defining those types. Sorry, I used "private impls" as a shorthand to mean "private outside this module."</p>



<a name="216822393"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216822393" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216822393">(Nov 16 2020 at 00:19)</a>:</h4>
<p>or is this some situation where the impls are <em>even more</em> private than the <code>Private</code></p>



<a name="216822478"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216822478" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216822478">(Nov 16 2020 at 00:21)</a>:</h4>
<p>It's not that sort of situation.</p>



<a name="216822527"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216822527" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216822527">(Nov 16 2020 at 00:22)</a>:</h4>
<p>Have you <a href="https://jack.wrenn.fyi/blog/private-trait-impls/">read this</a> by any chance? It might clarify what we mean by impl privacy.</p>



<a name="216822610"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216822610" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216822610">(Nov 16 2020 at 00:25)</a>:</h4>
<p>I <em>think</em> <span class="user-mention" data-user-id="120791">@RalfJ</span> is asking about whether you can make use of private impls across generic abstractions. <code>From</code> and its generic abstraction <code>Into</code> are prime examples of this. Check out this playground snippet for a full example: <a href="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=ba50ce384e29dbe2a36c4d7a0af1307c">https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=ba50ce384e29dbe2a36c4d7a0af1307c</a></p>



<a name="216822659"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216822659" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216822659">(Nov 16 2020 at 00:26)</a>:</h4>
<p>You couldn't, however "see" <code>&lt;Private as Into&lt;Public&gt;</code> or <code>&lt;Public as Into&lt;Private&gt;</code> <em>outside</em> of <code>crate_b</code> in that snippet, though.</p>



<a name="216822670"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216822670" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216822670">(Nov 16 2020 at 00:27)</a>:</h4>
<p>So it's obvious to me that <code>is_convertible::&lt;Public, Private&gt;()</code> can't textually be written outside the module, but perhaps your point is that type privacy is ensuring that there is no way to get a call to the function by other means either?</p>



<a name="216822730"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216822730" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216822730">(Nov 16 2020 at 00:28)</a>:</h4>
<p>In order to get some formal proof content out of this guarantee you would need the latter, which I guess is hard because of type inference. At least that's my understanding of Ralf's worry</p>



<a name="216822844"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216822844" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216822844">(Nov 16 2020 at 00:32)</a>:</h4>
<p>Actually, there <em>is</em> a deliberate hole in type privacy that <em>does</em> let us write <code>is_convertible::&lt;Public, Private&gt;()</code>outside of <code>crate_b</code> and therefore lets us observe that the <em>rest</em> of type privacy can be depended on to produce an error in that case.</p>
<p>You can see that at work here: <a href="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=35c0405857cb3b0548cc2a838fff5d48">https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=35c0405857cb3b0548cc2a838fff5d48</a></p>



<a name="216822906"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216822906" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216822906">(Nov 16 2020 at 00:34)</a>:</h4>
<p>I think your understanding of <span class="user-mention" data-user-id="120791">@RalfJ</span>'s worry is correct. <span class="user-mention" data-user-id="123856">@Vadim Petrochenkov</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety/near/216805918">observes that Rust *already* depends on these rules being airtight</a>.</p>



<a name="216824317"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216824317" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216824317">(Nov 16 2020 at 01:11)</a>:</h4>
<p>Impls don't have an explicit privacy setting, but it seems like you can say that they have the minimum visibility of the trait, and values for parameter types (but not associated types). Then a given function application involves chaining some impls together to prove the where clauses, and the minimum visibility of all those impls, the parameter types, and the function itself should be at least at the visibility level of the module containing the function call.</p>
<p>I think that can be formalized, over the "visibility lattice" consisting of <code>pub</code> and the modules ordered by nesting, with a bottom element for failure. Then the various public in private errors become the necessary conditions to establish well nesting of visibilities: for example, the general theorem that the associated types of an impl must be more visible than the impl itself, is enforced by a privacy check.</p>
<p>I think my model might still be off, because in <a href="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=8921ede3d294d9c6438a050704c4c034">this example</a></p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="w">    </span><span class="k">impl</span><span class="o">&lt;</span><span class="n">T</span><span class="o">&gt;</span><span class="w"> </span><span class="k">super</span>::<span class="n">Foo</span><span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="n">T</span><span class="w"> </span><span class="k">where</span><span class="w"> </span><span class="n">T</span>: <span class="nc">super</span>::<span class="n">Bar</span><span class="o">&lt;</span><span class="n">Private</span><span class="o">&gt;</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="k">type</span> <span class="nc">A</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">Private</span><span class="p">;</span><span class="w"></span>
<span class="w">        </span><span class="k">fn</span> <span class="nf">mk</span><span class="p">()</span><span class="w"> </span>-&gt; <span class="nc">Private</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">Private</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="w">    </span><span class="p">}</span><span class="w"></span>
</code></pre></div>
<p>the definition of "impl visibility" I gave would say that this impl is private, because it uses the private type <code>Private</code> in its where clause, but the error says that this is a public impl and errors on <code>type A = Private</code> as a private-in-public error.</p>



<a name="216824439"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216824439" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216824439">(Nov 16 2020 at 01:15)</a>:</h4>
<p>Oh, it seems that where clauses don't count toward impl visibility, and must in turn be at least as visible as the impl itself, which I guess makes sense</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">pub</span><span class="w"> </span><span class="k">trait</span><span class="w"> </span><span class="n">Bar</span><span class="o">&lt;</span><span class="n">A</span><span class="o">&gt;</span><span class="w"> </span><span class="p">{}</span><span class="w"></span>
<span class="k">pub</span><span class="w"> </span><span class="k">trait</span><span class="w"> </span><span class="n">Foo</span><span class="w"> </span><span class="p">{}</span><span class="w"></span>

<span class="k">pub</span><span class="w"> </span><span class="k">mod</span> <span class="nn">a</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="k">struct</span> <span class="nc">Private</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="k">impl</span><span class="o">&lt;</span><span class="n">T</span><span class="o">&gt;</span><span class="w"> </span><span class="k">super</span>::<span class="n">Foo</span><span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="n">T</span><span class="w"> </span><span class="k">where</span><span class="w"> </span><span class="n">T</span>: <span class="nc">super</span>::<span class="n">Bar</span><span class="o">&lt;</span><span class="n">Private</span><span class="o">&gt;</span><span class="w"> </span><span class="p">{}</span><span class="w"> </span><span class="c1">// ERROR: private type `Private` in public impl</span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>



<a name="216824450"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216824450" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216824450">(Nov 16 2020 at 01:15)</a>:</h4>
<p>Yep! Have you see the <a href="https://github.com/rust-lang/rfcs/blob/master/text/2145-type-privacy.md">Type Privacy RFC</a>, yet? Its rules are what's underpinning our current discussion. When we say "private impl", we mean it in the sense of that RFC.</p>



<a name="216824510"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216824510" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216824510">(Nov 16 2020 at 01:16)</a>:</h4>
<p>yes, I've read it. I'm trying to see what it would take to formalize</p>



<a name="216824585"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216824585" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216824585">(Nov 16 2020 at 01:18)</a>:</h4>
<p>So in the RFC, it's a "double check"? I.e. we have the local rules on impls already, but there is also a check at actual point of use (that in principle should have been stopped by the lints)?</p>



<a name="216824606"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216824606" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216824606">(Nov 16 2020 at 01:19)</a>:</h4>
<p>Is this only because of the leaky public-in-private warning, or is it because we don't trust that the rest of it is actually airtight</p>



<a name="216824680"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216824680" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216824680">(Nov 16 2020 at 01:21)</a>:</h4>
<p>If there is a check at point of use, it's not hard to make it airtight: If you check that X holds then it does. The system of local checks don't matter in that case</p>



<a name="216848847"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216848847" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Vadim Petrochenkov <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216848847">(Nov 16 2020 at 09:32)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety/near/216824585">said</a>:</p>
<blockquote>
<p>So in the RFC, it's a "double check"? I.e. we have the local rules on impls already, but there is also a check at actual point of use (that in principle should have been stopped by the lints)?</p>
</blockquote>
<p>Type privacy check at the point of use is the <em>main</em> check, it's fully implemented and works correctly (to extent of my knowledge).<br>
The local check (private-in-public lint) is badly working, leaky and the intention is to remove it and replace with a couple of lints that work slightly differently, using reachability heuristics (the RFC writes about this).</p>



<a name="216849384"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216849384" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216849384">(Nov 16 2020 at 09:38)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety/near/216824510">said</a>:</p>
<blockquote>
<p>yes, I've read it. I'm trying to see what it would take to formalize</p>
</blockquote>
<p>awesome. :)<br>
to be clear, what I meant by "formalize" is having formal reasoning principles for unsafe code that exploit this. something like what <a href="https://plv.mpi-sws.org/rustbelt/popl18/">this paper</a> did for the way more common pattern of unsafe code relying on field privacy (which enables unsafe code to attach invariants to all inhabitants of a type, which is really the foundation of everything in that paper). of course I do not expect something fully worked out and formalized in Coq^^ but so far I couldn't even <em>sketch</em> a soundness proof of a module relying on type privacy. To be fair, I also did not spend much time trying to come up with such a sketch.<br>
it'd be great to have a small self-contained example of code needing type privacy (<span class="user-mention" data-user-id="219211">@Jack Wrenn</span> has posted such examples in the past), adjusting it so that type privacy is truly needed <em>for soundness</em> (i.e., adding a <code>pub</code> somewhere lets safe code actually cause UB), and then start sketching out a solid argument for soundness of this code.</p>



<a name="216854018"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216854018" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216854018">(Nov 16 2020 at 10:29)</a>:</h4>
<p>I think the basic mechanism behind turning type privacy into a logical invariant is that the "soundness" property of a safe private function (one that does not use <code>unsafe fn</code>) quantifies not over all possible safe code that pokes at the function, but instead comes with its own invariant, where the invariant only has to hold over all callers inside the module, which by type privacy are all possible callers. In other words, it is a license to treat a <code>fn</code> as if it was <code>unsafe fn</code>, with possible nontrivial preconditions.</p>



<a name="216854354"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216854354" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216854354">(Nov 16 2020 at 10:33)</a>:</h4>
<p>For example, both functions <code>f</code> and <code>foo</code> are sound in the following code:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">mod</span> <span class="nn">a</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="k">fn</span> <span class="nf">f</span><span class="p">(</span><span class="n">x</span>: <span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="kt">u8</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="kt">u8</span> <span class="p">{</span><span class="w"> </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="o">*</span><span class="n">x</span><span class="p">}</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="w">    </span><span class="k">pub</span><span class="w"> </span><span class="k">fn</span> <span class="nf">foo</span><span class="p">()</span><span class="w"> </span>-&gt; <span class="kt">u8</span> <span class="p">{</span><span class="w"> </span><span class="n">f</span><span class="p">(</span><span class="o">&amp;</span><span class="mi">42</span><span class="p">)</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>
<p><code>foo</code> is safe because it just returns <code>42</code>, and <code>f</code> is safe because it can only be called on <code>&amp;42</code></p>



<a name="216855918"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/216855918" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#216855918">(Nov 16 2020 at 10:50)</a>:</h4>
<p>Now that uses a private function instead of a private type, but the idea is the same. A type permits access to various trait impl functions, which in turn can have narrow contracts. Here is an example with a private type:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">trait</span><span class="w"> </span><span class="n">Foo</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="k">fn</span> <span class="nf">f</span><span class="p">(</span><span class="n">x</span>: <span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="kt">u8</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="kt">u8</span><span class="p">;</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="k">mod</span> <span class="nn">a</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="k">use</span><span class="w"> </span><span class="k">super</span>::<span class="n">Foo</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="k">struct</span> <span class="nc">Private</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="k">impl</span><span class="w"> </span><span class="n">Foo</span><span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="n">Private</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="k">fn</span> <span class="nf">f</span><span class="p">(</span><span class="n">x</span>: <span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="kt">u8</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="kt">u8</span> <span class="p">{</span><span class="w"> </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="o">*</span><span class="n">x</span><span class="p">}</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="w">    </span><span class="p">}</span><span class="w"></span>
<span class="w">    </span><span class="k">pub</span><span class="w"> </span><span class="k">fn</span> <span class="nf">foo</span><span class="p">()</span><span class="w"> </span>-&gt; <span class="kt">u8</span> <span class="p">{</span><span class="w"> </span><span class="n">Private</span>::<span class="n">f</span><span class="p">(</span><span class="o">&amp;</span><span class="mi">42</span><span class="p">)</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
<span class="k">fn</span> <span class="nf">evil</span><span class="p">()</span><span class="w"> </span>-&gt; <span class="kt">u8</span> <span class="p">{</span><span class="w"> </span><span class="n">a</span>::<span class="n">Private</span>::<span class="n">f</span><span class="p">(</span><span class="n">std</span>::<span class="n">ptr</span>::<span class="n">null</span><span class="p">())</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
</code></pre></div>
<p>The function <code>evil()</code> doesn't compile due to type privacy, but if <code>Private</code> were public it would cause UB. Here we can argue that the implementation of <code>Private::f</code> is sound even though it doesn't match the contract of the global <code>Foo</code> trait (which necessarily has a broad contract since it is a safe function) because we can enumerate all possible callers of <code>Private::f</code> and they only ever call it in a safe way.</p>



<a name="217119994"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/217119994" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Henry-Mantilla <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#217119994">(Nov 18 2020 at 10:57)</a>:</h4>
<p><span class="user-mention" data-user-id="219211">@Jack Wrenn</span> interestingly enough, not even type inference can bypass this kind of privacy <span aria-label="dizzy" class="emoji emoji-1f635" role="img" title="dizzy">:dizzy:</span> <span aria-label="muscle" class="emoji emoji-1f4aa" role="img" title="muscle">:muscle:</span> : <a href="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=69d243b468bfbafc4f44da1dce615b0a">https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=69d243b468bfbafc4f44da1dce615b0a</a></p>



<a name="217139763"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/217139763" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#217139763">(Nov 18 2020 at 14:20)</a>:</h4>
<p>Yeah, that's by design! It's awesome.</p>



<a name="217500176"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/217500176" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#217500176">(Nov 21 2020 at 12:38)</a>:</h4>
<p><span class="user-mention silent" data-user-id="271719">Mario Carneiro</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety/near/216854354">said</a>:</p>
<blockquote>
<p>For example, both functions <code>f</code> and <code>foo</code> are sound in the following code:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">mod</span> <span class="nn">a</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="k">fn</span> <span class="nf">f</span><span class="p">(</span><span class="n">x</span>: <span class="o">*</span><span class="k">const</span><span class="w"> </span><span class="kt">u8</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="kt">u8</span> <span class="p">{</span><span class="w"> </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="o">*</span><span class="n">x</span><span class="p">}</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="w">    </span><span class="k">pub</span><span class="w"> </span><span class="k">fn</span> <span class="nf">foo</span><span class="p">()</span><span class="w"> </span>-&gt; <span class="kt">u8</span> <span class="p">{</span><span class="w"> </span><span class="n">f</span><span class="p">(</span><span class="o">&amp;</span><span class="mi">42</span><span class="p">)</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>
<p><code>foo</code> is safe because it just returns <code>42</code>, and <code>f</code> is safe because it can only be called on <code>&amp;42</code></p>
</blockquote>
<p>to me that sounds like just saying, private functions do not have to be sound. there's nothing useful to show about <code>f</code> (except private internal lemmas), which means every caller needs to carefully justify its call, which could be considered okay because <code>f</code> is private.<br>
but I do not see how that helps to talk about public functions, where we need a proof that they abide by the contract determined by their type.</p>



<a name="217524854"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/217524854" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mario Carneiro <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#217524854">(Nov 21 2020 at 23:42)</a>:</h4>
<p>I think that's more or less correct. Private functions are effectively <code>unsafe</code> by default: they can have additional preconditions for soundness beyond what their type says, and as long as all callers in the module abide by these added preconditions then everything is a-ok because outside the module they aren't just unsafe, they are not callable at all. (Of course, a private function can also choose to not have preconditions, and just be sound in the usual sense. But this isn't a requirement.) For public functions, they need to abide by the contract determined by their type, that is as it always has been.</p>



<a name="217544205"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Type%20Privacy%20%26%20Safety/near/217544205" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Type.20Privacy.20.26.20Safety.html#217544205">(Nov 22 2020 at 10:06)</a>:</h4>
<blockquote>
<p>Private functions are effectively unsafe by default: they can have additional preconditions for soundness beyond what their type says, and as long as all callers in the module abide by these added preconditions then everything is a-ok because outside the module they aren't just unsafe, they are not callable at all. </p>
</blockquote>
<p>That's a matter of convention. I'd call even a private function unsound if safe code can cause UB by calling it. We can of course make private functions sound <em>by fiat</em> but I don't think that actually provides any <em>insight</em>, and I do not see how it helps explain private types.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>